Regulatory changelog
This page reflects our reading of Cyber Resilience Act, Articles 13 and 14, Annexes I, II, V, VI and VII; ENISA SRP guidance as of . It is not legal advice. Review process.
This log records changes to the regulation and the reporting platform Declara tracks — not changes to Declara itself. It's what lets you tell "the law changed" apart from "the product changed." Product release notes live separately.
Convention
One entry per regulatory change, dated YYYY-MM-DD, with a link to its primary
source. Entries are added, never edited in place — if a source is later corrected,
a new entry records that.
Entries
2026-09-11 — CRA Article 14 reporting obligations take effect
The Cyber Resilience Act's Article 14 reporting duties — early warning, notification, and final report for actively exploited vulnerabilities and severe incidents — became applicable on this date, ahead of the Act's general application date.
Source: Cyber Resilience Act, Article 14, checked 2026-09-13.
2026-09-11 — ENISA CRA Single Reporting Platform goes live, web-form only, no API
The SRP launched as the single point of filing to a CSIRT and ENISA simultaneously. It is a web form; there is no API to submit through as of this writing, which is why Declara's report packets are copied into the SRP manually rather than submitted automatically.
Source: ENISA CRA Single Reporting Platform FAQ, checked 2026-09-13.
2026-07-27 — Commission guidance on applying the CRA, C(2026) 5252
Non-binding guidance on the Regulation's application, including when a change to a product is a substantial modification (a test of four factors, with security updates generally not one) and how the support period is reassessed after one. Declara's modification log shows an indication from these factors; the paragraph numbers it cites come from a secondary reading and have not yet been checked against the Commission's text.
Source: Commission CRA page; secondary summary at cvdportal.com, checked 2026-10-09.
Added 2026-10-10: Record a product's support period now also relies on this guidance, for reassessing the support period after a substantial modification. Its factors are cited to Article 13(8) itself. Any paragraph number from the guidance on the support-period factors comes from the same secondary reading and is still unchecked against the Commission's text.
2026-09-11 — ENISA SRP user manual: notification statuses
The Assigned Representative user manual (v1.1) describes a notification as Submitted, then Valid or Invalid as the coordinating CSIRT checks it, then Closed, and keeps it editable until the final report is submitted. Declara records these statuses against each filed stage; see Track a filing.
Source: ENISA SRP AR User Manual, checked 2026-10-09.
2026-10-01 — SRP Glossary version 1.4
The field-by-field definition of the platform's forms. Against 1.3, it adds when the actively exploited vulnerability occurred (v26a, required at 72 hours), offers further information for the coordinating CSIRT (v30) from the early warning, adds the assigned representative's note (#40), offers the CVE and EUVD identifiers at the early warning, and makes the incident occurrence time (i38) optional at the final report. Declara's report packets follow 1.4.
Source: ENISA CRA SRP Glossary, checked 2026-10-09.
2026-10-03 — The platform's displayed 72-hour deadline is a known error
ENISA's FAQ 26 says the platform shows the notification as due 48 hours after the early warning is submitted, and that this will be corrected in a later release. The legal deadline is 72 hours from awareness. Declara shows the platform's time beside the legal one and uses only the legal one. ENISA does not date individual answers; the date here is when the answer was last checked.
Source: ENISA SRP FAQ (mirrored at cra.orcwg.org), checked 2026-10-09.
2027-12-11 — Article 13(5): due diligence on third-party components
A manufacturer exercises due diligence when integrating components sourced from third parties, free and open-source ones included, so that they do not compromise the product's cybersecurity. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Review a third-party component, Request SBOMs from your suppliers, Answer a market-surveillance request, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(6): reporting a vulnerability in a component upstream
On identifying a vulnerability in an integrated component, a manufacturer reports it to whoever manufactures or maintains the component, and shares any fix it develops. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Report a vulnerability upstream, Answer a market-surveillance request, Understand your first alert, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(8): the support period
Vulnerabilities are handled for the support period, which reflects the expected use time and the factors the paragraph lists, and is at least five years unless the product is expected to be in use for less. The information behind it goes in the technical documentation (Annex VII(4)). Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Record a product's support period, Record a substantial-modification decision, Publish a product's Trust Center, Answer a customer's supplier questionnaire, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(13): keeping the technical documentation
A manufacturer keeps the technical documentation and the EU declaration of conformity at the disposal of market surveillance authorities for at least ten years after the product is placed on the market or for the support period, whichever is longer. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Record a product's support period, Answer a market-surveillance request, Answer a customer's supplier questionnaire, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(19): the end date of the support period
The end date of the support period, including at least the month and the year, is clearly and understandably specified at the time of purchase in an easily accessible manner and, where applicable, on the product, its packaging or by digital means. Where technically feasible, users are shown a notification when the product reaches the end of its support period. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Record a product's support period, Publish a product's Trust Center, Answer a customer's supplier questionnaire, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(18): information and instructions to the user
A product is accompanied by the Annex II information, in a language users and authorities easily understand, kept available for at least ten years or the support period, whichever is longer. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Draft a product's user information, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(20): the full or simplified declaration of conformity
A product is accompanied by a copy of the EU declaration of conformity or by the simplified declaration, which gives the exact internet address of the full one. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Publish a product's Trust Center, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Article 13(22): answering a market surveillance authority
On a reasoned request, a manufacturer gives a market surveillance authority all the information and documentation needed to show conformity with Annex I, in a language it easily understands, and cooperates with it. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Answer a market-surveillance request, Answer a customer's supplier questionnaire, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Annex I Part I(2)(a): no known exploitable vulnerabilities
On the basis of the risk assessment and where applicable, a product is made available on the market without known exploitable vulnerabilities. Declara's release gate checks for known exploited ones and tier A matches: a signal, not a conformity verdict. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Gate a release in CI, What the CRA requires of you, FAQ.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Annex II: information and instructions to the user
Nine points the user information contains at minimum, point 8 in six parts (a) to (f), and point 9 for where the SBOM can be accessed if the manufacturer makes it available. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Draft a product's user information, Share an SBOM with a customer, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Annex V: content of the EU declaration of conformity
The eight elements a full declaration contains, from the product's identification to the signature. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Draft a product's technical file, Publish a product's Trust Center.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Annex VI: the simplified EU declaration of conformity
The one-sentence form of the declaration, with the internet address at which the full text is available. Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Publish a product's Trust Center, What the CRA requires of you, FAQ.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.
2027-12-11 — Annex VII: content of the technical documentation
The eight points the technical documentation contains, including the support-period reasoning (point 4) and the SBOM on an authority's reasoned request (point 8). Applies from 11 December 2027 (Art. 71(2)).
Relied on by: Draft a product's technical file, Answer a market-surveillance request, Answer a customer's supplier questionnaire, Record the essential requirements and risk assessment, What the CRA requires of you.
Source: Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10.